Repository navigation
Feature: client-side site search (Pagefind) - #62
Merged
Merged
Conversation
- deploy.yml gains a Pagefind index step after the build (pinned 1.5.2, runner's preinstalled Node, output/pagefind/) - /search/ shell page (TEMPLATE_PAGES): noindex + sitemap-excluded, self-canonical, Search menu item added - zero inline scripts: UI init lives in theme/js/search-init.js, so the csp_audit gate and a script-src 'self' CSP both hold; all assets and index chunks fetch same-origin - indexing scoped via data-pagefind-body on non-draft article bodies and non-hidden pages: 23 pages indexed = 21 posts + About + Accessibility; /drafts/ pages structurally cannot enter the index
rivassec
added a commit
that referenced
this pull request
Sep 12, 2026
Search is Pagefind (/search/, PR #62). The tipue and stork branches were guarded by PLUGINS entries that have never been set here, so the assets (484KB) and their template hooks were dead weight - including an inline onclick handler that only stayed out of csp_audit's sight because its branch never rendered. Also removes the unused tipue search.html results template. Co-authored-by: rivassec <rivassec@rivassec.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Item 2, the last of the improvement list. Static, same-origin, CSP-clean search.
What
npx --yes pagefind@1.5.2 --site outputwrites the UI assets and chunked index tooutput/pagefind/(runner's preinstalled Node; version pinned). Placed before the csp_audit and lychee steps so both validate the search page.noindex, follow+ excluded from the sitemap (search shells are thin content), self-canonical, with a noscript fallback pointing at Categories and the Guide.Searchadded to the menu.theme/js/search-init.js(no inline scripts - the csp_audit CI gate enforces this anyway), and every asset + index chunk fetches same-origin. When the Cloudflare security headers come back,script-src 'self'; connect-src 'self'works unchanged.data-pagefind-body, applied only to non-draft article bodies and non-hidden pages. With attribute scoping active, Pagefind ignores every page without it.Verified locally (full deploy dress rehearsal)
Note for reviewer
While testing this I confirmed the live site currently serves no security headers at all (no CSP/XFO) - the Cloudflare-dashboard headers from docs/security-headers.md have drifted. Separate from this PR (needs your Cloudflare access), but worth restoring; the site is CSP-ready per the csp_audit gate and this PR keeps it that way.